supporting new flag 'isREST'

related to: REST security bug: after 5 login failures, account locked
but user is logged in !! #43